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Authorization and Approval 


Responsibility: Associate Director, Arrow Public Library 
Authorization: Director, Arrow Public Library 
Approval Date: March 9, 2021 (reviewed annually) 


Purpose 


The purpose of this Policy is to advise the Arrow Public Library’s (the “Library”) employees and 
its users on how the Library complies with its obligations under The Local Authority Freedom of 
Information and Protection of Privacy Act (the “Act”) to protect the privacy and ensure 
confidentiality of Personal Information in the possession or under the control of the Library. The 
Policy, supporting the overall Library’s mission and vision to preserve and disseminate human 
knowledge and Canada’s heritage, is based on the core principles of the Canadian Federation of 
Library Associations, Library and Archives of Canada Act, and American Library Association’s 
Code of Ethics and The Freedom to Read Statement. 


Principles 


The Library, in accordance with the terms and conditions of this Policy and the Act, will take 
reasonable measures to protect and maintain the privacy of any Personal Information in its 
possession or under its control. 


Scope of this policy 


This Policy applies to all employees of the Library who have access to Personal Information. 
This Policy applies to Personal Information recorded in any format. 


Policy 
1. Definitions 
In this Policy: 


e “Act” means The Local Authority Freedom of Information and Protection of Privacy 
Act; 

e “Authorized Employee” means an employee whose position and/or duties require 
access to Personal Information in the possession or under the control of the Library; 

e “Confidentiality” means the Library’s obligation to keep personal identifiable 
information about users private; 

e “Personal Information” means personal information about an identifiable individual 
that is recorded in any form, as defined by Section 23 of the Act; 


PRIVACY RIGHTS AND CONFIDENTIALITY POLICY 


e “Privacy” means the right to read, inquire, think, and create without being observed 
by others; 

e “Third Party” means a person, group, or an organization, other than a person to whom 
the Personal Information belongs; 

e “Library” means the Arrow Public Library. 


2. Protection of Privacy 


a. Collection of Personal Information 


Personal Information will be collected only in the following instances: 


When it is required for the proper administration, services, or general operations of the 
Library; 

When is authorized by the Government of Canada or the Province of Saskatchewan; 

For the security purposes and conducted by authorized law enforcement in possession of 
a court order, when, for example, the Library software identifies unauthorized attempts to 
cause damage to the Library’s website. 


At the point when Personal Information is collected, persons will be provided with the reason(s) 
why the collection is necessary, the purpose for which this information is collected, and about 
the rights to access such collected information. 


Personal Information about a person will be collected directly from that person. 


The Library, based on its confidentiality agreements, collects the user information that is directly 
related to the library’s borrowing and communications services logs, and includes: 


First and last name; 

Home address; 

Home phone number; 

E-mail address; 

Circulation records; 

In-person, chat, text, or phone requests; 

Reserve, recall, hold, and interlibrary loan requests; 
Computer and server logs. 


Personal Information that is captured automatically on the Internet includes: 


The date and time when the Library’s website was accessed; 

The IP address of a computer used to access the Library’s website; 

The type of Internet browser and computer operating system used to access the Library; 
The Library’s webpages visited during the connection; 

The user’s website address used to connect to the Library’s website. 
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The above captured information is not linked to the individual person and helps the Library to 
determine the number of website visitors, traffic, and the types of technology used to visit the 
Library. The collected information is not used to track an individual person or record information 
sought during the Library visit. 


The Library visitor’s information will not be shared with Third Parties; it will be used by 
Authorized Employees to respond back with information that was requested by that user. 


Cookies used by the Library’s website do not collect or submit to Third Parties any Personal 
Information about the Library users. 


The Library uses the Customer Relationship Management for Libraries (LibCRM) platform, to 
develop long-term relationships with its users. The Library keeps records for seven years after 
the last interaction with the user. 


The Library’s website may content links to other websites. The Library is not responsible for the 
privacy and confidentiality practices of Third Parties’ websites. We recommend users to 
familiarize themselves with each individual site’s privacy and confidentiality polices and 
guidelines. 


The Library does not sell or share identifiable Personal Information with commercial, marketing, 
or advertising organizations. 


b. Confidentiality and Protection of Identifiable Personal Information 
The Library employees will take reasonable measures to keep confidential and protect 
identifiable Personal Information from an unauthorized access, collection, disclosure, retention, 
or destruction. 


Only Authorized Employees will have access to identifiable Personal Information. 


Personal Information will be accessed by Authorized Employees only for the purposes outlined 
in Paragraph 2 (c) and (d) of this Policy. 


Personal Information will be stored in secure location(s) not accessible to other than Authorized 
Employees. 


Physical copies containing Personal Information will be kept in secured/locked rooms and/or 
filing cabinets. 


Electronic copies containing Personal Information will be in secured/password-protected 
formats. 


The Library will protect the Personal Information by hiding full names of users on self-service 
“hold” shelves and not sending postcard renewal notices or leaving voice-mail messages. 
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c. Use of Personal Information 
The Library may only use Personal Information for: 


e Purpose(s) it was collected; 

e Purpose(s) authorized by the Act; 

e Other purposes authorized by the person to whom the Personal Information belongs, or 
someone duly authorized to provide consent on behalf of that person. 


d. Disclosure of Personal Information 


The Library will only disclose Personal Information to a Third Party or make it available to the 
general public: 


e For the purpose(s) it was collected and authorized; 

e For the purpose(s) authorized by the Act, Government of Canada of the Province of 
Saskatchewan and in response to an executed court order; 

e For any other purpose(s) authorized by the person to whom the Personal Information 
belongs, or someone duly authorized to provide consent on behalf of that person. 


e. Access to Personal Information 


The Library will ensure all Personal Information in its possession or under its control is accurate 
for the purpose(s) for which it was collected. 


Unless restricted by the Act, Government of Canada, or the Province of Saskatchewan, persons 

have the right to access their own Personal Information that is in the possession of the Library. 

Persons may request to correct Personal Information about themselves when it is inaccurate or 

incomplete. The Library will review these requests and correct information as soon as possible. 
f. Retention and Disposal of Personal Information 


The Library will retain Personal Information according to the approved retention schedule. 


The Library will purge users’ Personal Information records after 2 years of inactivity (unless 
there are borrowed items, fines, or other outstanding activities). 


The Library will on a monthly basis purge users’ identifiable Personal Information such as 
surveillance tapes, material circulation, and communication logs. 


Personal Information identified as having historical value will be retained permanently and will 
be disclosed in accordance with the Act. 


The Library will keep de-identifiable and aggregated Personal Information for statistical and 
metrics purposes to help improving the Library’s services. 
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Personal Information, once no longer needed for administrative, operational, legal, or historical 
reasons, will be destroyed as follows: 
e Physical copies will be shredded or incinerated; 
e Electronic copies will be deleted using technology ensuring such records could not be 
recovered. 


Responsibilities 


Associate Director is the designated person for the purposes of Section 2 (e) of the Act and is 
authorized to make decisions on behalf of the Library pursuant to this Policy. 


Non-compliance 

In case of non-compliance, the Library may take a legal action that could result in criminal or 
civil proceedings, or a disciplinary action in accordance with applicable collective agreements 
or/and laws that could result in immediate termination of employment. 

Procedures 

The Library may establish guidelines and procedures related to this Policy if required. 
Contact Person: Associate Director, Arrow Public Library 


Email: associate_director @ arrow. public. library 
Phone: 306-123-4567 
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